Passwords: How Often?

In recent news, people are being to change their passwords because of a flaw in program that makes internet connection secure, OpenSSL. There is a lot of material out on how this system worked and how hackers exploited this flaw, so I am not going to rehash material that is already out there.

Instead, I want to focus on passwords themselves. In earlier blogs, I explained ways of how to create more secure passwords, rational why you should use a different password for each account, and the advantages of using a password vault. However, I never visited the subject of how often you should change a password.

If you have a Microsoft live account, you may have noticed that they have an option a checkbox you can click to make you change your password every 72 days. If you work for a company where you have to sign-in or log-on your work computer, you might have to change your password at least every 3 months.

The reason for changing your password from time to time is to close a security hole if your password in cases where your password had been compromised. Essentially your password is a key to unlocking access to your account, like a key to your home. If someone has a copy of your key, he/she can enter your house at any time. They can choose to trash your home, steal your valuables, or collect information about you. Likewise, if someone has your password, they can damage files on your compute, steal funds from your accounts, or collect information on you and your business.

Changing your password is like changing your locks. This way if someone is getting access because someone has a key, changing the lock takes away the ability to use that key. The important thing is when you change your password is that you do not use a similar password. For example, many people will use something like “ruMpl_stilskin!” and then change it to “ruMpl_stilskin!1” and then later to “ruMpl_stilskin!2”. A smart hacker will always check for those variations. (Side note: the same is true for home locks. If your lock has a similar pin configuration aka key cut as your old lock, a thief can use a technique that will make your old key work in the new lock.)

Ok, so changing your password is a good thing, but how often should you do it? My rule of thumb, the more important the information, the more often you should change it. Does that mean you go crazy and change it daily? In my opinion, if it is that important that you need to change it daily, you should really look at a different way to store the information. In most cases, I think every 30 to 60 days is a reasonable timeframe. Again, if they are more sensitive, you should change them more frequently. I also should stress, you need to change every account periodically, even those with little information you need to keep secure.

There are times when you need to change your all of your passwords immediately; in anywhere are least one of your passwords has been or may have been compromised. The reason being that if the hacker had access to one account, he/she may have been able to collect information related to your other passwords.